1 / 17

Use After Free

Use After Free. Defcon Russia # 14 21 Feb. 2012 by @ asintsov. Agenda. Use-After-Free Heap Spray Address l eak ASLR => calc.exe. Excluded. Shellcode dev. Heap Spray Metasploit (btw, there is workshop by Rick!) Sandboxing

rhea-chandler
Download Presentation

Use After Free

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Use After Free Defcon Russia # 14 21 Feb. 2012 by @asintsov

  2. Agenda • Use-After-Free • Heap Spray • Address leak • ASLR => calc.exe

  3. Excluded • Shellcode dev. • Heap Spray • Metasploit (btw, there is workshop by Rick!) • Sandboxing • Advanced techniques by N. Tarakanov 8) • Browser’s vulns

  4. Environment Target ? • IE8 x32 • IE9 • Windows 7 Tools ? • Immunity Debugger • mona.py • notepad • http://immunityinc.com/products-immdbg.shtml • http://redmine.corelan.be/projects/mona/repository/raw/trunk/1.8/mona.py

  5. Evolution Difficult 1990 1995 2000 2005 Year 2010 Expolit development Finding vulns. Stolen fromDino Dai Zovi

  6. Hey! Ho! Let’s go!

  7. theory.getShellcode(); • Assembler instructions • Program • Shell 8-) EIP ---------> AsmCode that doing something bad

  8. theory.getHeap(); 0x0c0c0c0c • Process Memory • Modules • Vuln. module. • System modules • Heap pages - Nopsled - Shellcode

  9. theory.getHeap(‘IE9’); • Array of strings (substring()…)… Header(0x10) 0061 0061 0061 0061 0061 0061 0061 0061 00 00

  10. ASLR / ROP /GS /safeSEH

  11. theory.getUAF()[0]; • Process Memory • Modules • Object with pointer • System modules • Heap pages CALL 0x0C0C0C0C Object *obj = (Object *)malloc(sizeof(Object)); obj->callMethod(); free(obj); HeapSpray(0x0c0c0c0c); obj->callMethod();

  12. theory.getUAF()[1]; • - Some objects • Object with pointer • Attacker’s blocks 1) Free(); 2) Spray(); SIZE MATTERS

  13. workshop.getUAF(); \part2\bin\uaf.bat \part2\exercises\Fig1\demo.htm Task 8: Find UAF -------------------------------------------------------------------------------- Task 9: Rewrite object by using InitString(); -------------------------------------------------------------------------------- Full armored: ALSR/DEP/GS/SEH/SEHOP vulnPlugin2.InitRed(31337,0x31333331); vara = vulnPlugin2.CallRed(); alert(a); //a=31337 vulnPlugin2.FreeRed(); vulnPlugin2.InitGreen(666,0x31333331); varb = vulnPlugin2.CallRed(); alert(b); //b= ??? Useless ROP

  14. theory.getLeak()[0]; , Freed… Obj1 • - Data • Pointer Obj2, same size… Obj2.ReadData() ---- ???

  15. theory.getLeak()[1]; , Freed… Obj1 Task 10: Get leak by using InitOther(); -------------------------------------------------------------------------------- • - Data • Pointer Obj2, same size… Obj1.ReadData() ---- ???

  16. workshop.exploitUAF(); • Task 11: \part2\exercises\Fig2\final.htm • Exploit Leak! • Build ROP by leaked address • Make pwning ESP (stack pivot) ESP -> HeapSpray -> ROP • Make heap executable • Run shellcode!

  17. delete workshop; twitter.com/asintsov alexey.sintsov@nokia.com www.defcon-russia.ru www.zeronights.ru

More Related